[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","StonedSheamus","name","The-Wandering-Clerik","path","main.ts","project",{"_22":46,"_11":12,"_33":47,"_48":-5,"_49":42,"_50":51,"_52":51,"_53":54,"_55":-5,"_56":57,"_58":25,"_59":32,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_13":45},"permalink","https://www.val.town/x/StonedSheamus/The-Wandering-Clerik/code/main.ts","extension","id","51ccd0db-9a32-44c3-9e92-6dff8eff555d","fileId","77260020-aa18-11f1-9dac-1607ee4eb77e","parentId","branchId","14611edd-64e7-4a83-ae11-563983a50244","branchVersion",65,"latest",true,"createdAt",["D",1789326312713],"version",17,"fileType","http","content","// =============================================================================\n// main.ts (Val Town side) — this val handles two things, both quick\n// request/response and well within Val Town's timeout:\n// 1. The one-click broadcaster onboarding pages (/onboard, /oauth/callback)\n// 2. A small authenticated REST API over SQLite storage, used by the\n// bot itself — which runs as a scheduled GitHub Actions workflow,\n// not on Val Town, since Val Town can't hold a connection open long\n// enough for a real-time chat bot without a paid plan.\n// =============================================================================\n//\n//\nimport {\n addChannel,\n deleteCharacter,\n getChannels,\n getCharacter,\n getMerchantOffers,\n getMeta,\n getQuestBoard,\n initStore,\n removeChannel,\n saveCharacter,\n saveMerchantOffers,\n saveQuestBoard,\n setMeta,\n} from \"./store.ts\";\nimport { exchangeCodeForToken, getAuthorizingUser } from \"./helix.ts\";\n\nconst CLIENT_ID = Deno.env.get(\"TWITCH_CLIENT_ID\") || \"\";\nconst API_SECRET = Deno.env.get(\"API_SHARED_SECRET\") || \"\";\nconst HOME_CHANNEL = (Deno.env.get(\"TWITCH_CHANNEL\") || \"\").toLowerCase()\n .trim();\nconst ADMIN_USERNAMES = (Deno.env.get(\"ADMIN_USERNAMES\") || \"\")\n .split(\",\").map((s) => s.trim().toLowerCase()).filter(Boolean);\nconst ADMIN_SESSION_SECRET = Deno.env.get(\"ADMIN_SESSION_SECRET\") || \"\";\n\nif (!API_SECRET) {\n console.error(\n \"Missing API_SHARED_SECRET env var — the storage API will reject every request until this is set.\",\n );\n}\nif (!ADMIN_SESSION_SECRET) {\n console.error(\n \"Missing ADMIN_SESSION_SECRET env var — the /admin panel will refuse to issue sessions until this is set.\",\n );\n}\nif (!HOME_CHANNEL) {\n console.error(\n \"Missing TWITCH_CHANNEL env var — the /admin panel won't recognize the broadcaster until this is set.\",\n );\n}\n\nconst globalAny = globalThis as any;\nif (!globalAny.__huntAndHoardInit) {\n globalAny.__huntAndHoardInit = true;\n await initStore();\n console.log(\"Hunt & Hoard storage + onboarding service ready.\");\n}\n\nfunction redirectUriFor(req: Request): string {\n const url = new URL(req.url);\n const host = url.host.replace(/\\/+$/, \"\");\n return `${url.protocol}//${host}/oauth/callback`;\n}\n\nfunction page(body: string, status = 200): Response {\n return new Response(\n `` +\n `The Wandering Clerk` +\n `${body}`,\n { status, headers: { \"content-type\": \"text/html\" } },\n );\n}\n\n// =============================================================================\n// Moderator-locked admin panel — lets the broadcaster or an approved\n// moderator turn whole sections of the bot on/off. Locked down with:\n// - Real Twitch sign-in (not just a hidden URL) to establish identity\n// - Server-side allowlist check (broadcaster login, or ADMIN_USERNAMES)\n// — never trust anything the client claims about who they are\n// - A signed, HttpOnly, Secure, SameSite=Strict session cookie (HMAC'd\n// with ADMIN_SESSION_SECRET) so the session can't be forged or read\n// by page scripts\n// - An OAuth `state` nonce (itself in a short-lived signed-equivalent\n// HttpOnly cookie) to prevent CSRF on the sign-in callback\n// - The toggle endpoint only accepts a fixed allowlist of setting keys,\n// and only ever trusts identity from the verified session cookie —\n// never from anything in the submitted form\n// =============================================================================\n\ninterface FeatureDef {\n key: string;\n label: string;\n description: string;\n}\n\nconst FEATURE_DEFS: FeatureDef[] = [\n {\n key: \"characters\",\n label: \"Character Enrollment\",\n description: \"!enlist, !chars / !ledger, !discharge\",\n },\n { key: \"combat\", label: \"Combat\", description: \"!hunt, !autohunt, !rest\" },\n {\n key: \"shop\",\n label: \"The Merchant's Stall\",\n description:\n \"!merchant, !buy, !sell, !coinpurse, !inventory, !item, !use, !drop\",\n },\n {\n key: \"quests\",\n label: \"The Quest Board\",\n description: \"!quests, and bounty auto turn-in from !hunt\",\n },\n {\n key: \"dice\",\n label: \"Dice Rolling\",\n description: \"!d20, !roll\",\n },\n {\n key: \"merchant_ads\",\n label: \"Merchant Restock Announcements\",\n description: \"Periodic stall turnover + chat announcement\",\n },\n {\n key: \"quest_ads\",\n label: \"Quest Board Refresh Announcements\",\n description: \"Periodic bounty board refresh + chat announcement\",\n },\n {\n key: \"item_lore\",\n label: \"Item Lore Stories\",\n description: \"Periodic ambient stories about items on the stall\",\n },\n {\n key: \"start_nudge\",\n label: \"Gentle Start Reminders\",\n description: \"Periodic invitation for newcomers to try !start / !enlist\",\n },\n];\nconst FEATURE_KEYS = FEATURE_DEFS.map((d) => d.key);\n\nasync function getFeatureFlags(\n channel: string,\n): Promise> {\n const raw = await getMeta(\"feature_flags\");\n const stored = raw ? JSON.parse(raw) : {};\n const channelStored = stored[channel] || {};\n const flags: Record = {};\n for (const key of FEATURE_KEYS) flags[key] = channelStored[key] !== false; // default: enabled\n return flags;\n}\n\nasync function setFeatureFlag(\n channel: string,\n key: string,\n enabled: boolean,\n): Promise {\n const raw = await getMeta(\"feature_flags\");\n const stored = raw ? JSON.parse(raw) : {};\n if (!stored[channel]) stored[channel] = {};\n stored[channel][key] = enabled;\n await setMeta(\"feature_flags\", JSON.stringify(stored));\n}\n\n// \"Super admin\" (you, or anyone in ADMIN_USERNAMES) can see and manage\n// every channel the Clerk serves. This check needs no storage lookup, so\n// it stays sync — callers that only need to know \"is this a super admin\"\n// (e.g. scoping which channels to show) can call it directly.\nfunction isSuperAdmin(login: string): boolean {\n const l = login.toLowerCase();\n return (!!HOME_CHANNEL && l === HOME_CHANNEL) || ADMIN_USERNAMES.includes(l);\n}\n\n// Anyone who has onboarded their own channel via /onboard is also allowed\n// into /admin — but only to manage that one channel (enforced separately\n// at the /admin and /admin/toggle routes below, not here). Without this,\n// a legitimate broadcaster who added the Clerk to their own channel would\n// sign in successfully and still be told they're \"not authorized\", since\n// they're neither HOME_CHANNEL nor in the static ADMIN_USERNAMES list.\nasync function isAuthorizedAdmin(login: string): Promise {\n const l = login.toLowerCase();\n if (isSuperAdmin(l)) return true;\n const channels = await getChannels();\n return channels.includes(l);\n}\n\nasync function hmac(secret: string, message: string): Promise {\n const enc = new TextEncoder();\n const key = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\"HMAC\", key, enc.encode(message));\n return btoa(String.fromCharCode(...new Uint8Array(sig))).replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\nfunction getCookie(req: Request, name: string): string | null {\n const header = req.headers.get(\"cookie\") || \"\";\n const match = header.match(new RegExp(\"(?:^|; )\" + name + \"=([^;]+)\"));\n return match ? decodeURIComponent(match[1]) : null;\n}\n\nconst SESSION_TTL_MS = 12 * 60 * 60 * 1000; // 12 hours\nconst STATE_TTL_SECONDS = 300; // 5 minutes, just long enough to complete the Twitch redirect\n\nasync function makeSessionCookie(login: string): Promise {\n const expiry = Date.now() + SESSION_TTL_MS;\n const sig = await hmac(ADMIN_SESSION_SECRET, `${login}.${expiry}`);\n const value = encodeURIComponent(`${login}.${expiry}.${sig}`);\n return `hh_admin_session=${value}; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=${\n Math.floor(SESSION_TTL_MS / 1000)\n }`;\n}\n\nfunction clearSessionCookie(): string {\n return `hh_admin_session=; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=0`;\n}\n\nasync function verifySession(req: Request): Promise {\n if (!ADMIN_SESSION_SECRET) return null;\n const raw = getCookie(req, \"hh_admin_session\");\n if (!raw) return null;\n const parts = raw.split(\".\");\n if (parts.length !== 3) return null;\n const [login, expiryStr, sig] = parts;\n const expiry = parseInt(expiryStr, 10);\n if (!expiry || Date.now() > expiry) return null;\n const expected = await hmac(ADMIN_SESSION_SECRET, `${login}.${expiryStr}`);\n if (!timingSafeEqual(sig, expected)) return null;\n if (!(await isAuthorizedAdmin(login))) return null; // re-check allowlist every time, not just at sign-in\n return login;\n}\n\nfunction adminRedirectUriFor(req: Request): string {\n const url = new URL(req.url);\n const host = url.host.replace(/\\/+$/, \"\");\n return `${url.protocol}//${host}/admin/callback`;\n}\n\nfunction adminPage(\n body: string,\n status = 200,\n extraHeaders: HeadersInit = {},\n): Response {\n return new Response(\n `` +\n `The Clerk's Back Room` +\n `${body}`,\n { status, headers: { \"content-type\": \"text/html\", ...extraHeaders } },\n );\n}\n\nasync function renderAdminSignIn(req: Request): Promise {\n const state = crypto.randomUUID();\n const authorizeUrl = new URL(\"https://id.twitch.tv/oauth2/authorize\");\n authorizeUrl.searchParams.set(\"client_id\", CLIENT_ID);\n authorizeUrl.searchParams.set(\"redirect_uri\", adminRedirectUriFor(req));\n authorizeUrl.searchParams.set(\"response_type\", \"code\");\n authorizeUrl.searchParams.set(\"scope\", \"\");\n authorizeUrl.searchParams.set(\"state\", state);\n // HttpOnly + Secure + SameSite=Strict already keeps this nonce out of\n // reach of any other site or script; comparing it against what Twitch\n // echoes back in the callback confirms the callback belongs to a flow\n // this same browser actually started (CSRF protection).\n const stateCookie = `hh_admin_state=${\n encodeURIComponent(state)\n }; HttpOnly; Secure; SameSite=Strict; Path=/admin; Max-Age=${STATE_TTL_SECONDS}`;\n return adminPage(\n `

The Clerk's Back Room

` +\n `

Only the broadcaster or an approved moderator may adjust these settings.

` +\n `

`,\n 200,\n { \"set-cookie\": stateCookie },\n );\n}\n\nfunction renderAdminDashboard(\n login: string,\n currentChannel: string,\n allChannels: string[],\n flags: Record,\n): Response {\n const channelTabs = allChannels.map((c) => {\n const isCurrent = c === currentChannel;\n const style = isCurrent\n ? \"display:inline-block;padding:6px 14px;margin:0 6px 6px 0;background:#9146FF;color:white;border-radius:6px;text-decoration:none;font-weight:bold;\"\n : \"display:inline-block;padding:6px 14px;margin:0 6px 6px 0;background:#eee;color:#333;border-radius:6px;text-decoration:none;\";\n return `#${c}`;\n }).join(\"\");\n\n const rows = FEATURE_DEFS.map((def) => {\n const enabled = flags[def.key];\n const nextValue = enabled ? \"0\" : \"1\";\n const statusColor = enabled ? \"#2e7a3e\" : \"#7a2e2e\";\n const btnColor = enabled ? \"#7a2e2e\" : \"#2e7a3e\";\n const btnLabel = enabled ? \"Turn off\" : \"Turn on\";\n return `\n \n \n ${def.label}
\n ${def.description}\n \n \n ${\n enabled ? \"ON\" : \"OFF\"\n }\n \n \n \n \n `;\n }).join(\"\");\n\n return adminPage(\n `

The Clerk's Back Room

` +\n `

Signed in as ${login} — sign out

` +\n `

Settings for:

` +\n `

${channelTabs}

` +\n `${rows}

` +\n `

These settings apply only to #${currentChannel} — other channels the Clerk serves keep their own. Changes take effect within a few minutes.

`,\n );\n}\n\ninterface CommandEntry {\n name: string;\n desc: string;\n}\ninterface CommandSection {\n title: string;\n commands: CommandEntry[];\n}\n\nconst COMMAND_SECTIONS: CommandSection[] = [\n {\n title: \"Getting Started\",\n commands: [\n { name: \"!help\", desc: \"The Clerk points you to this very ledger.\" },\n {\n name: \"!start\",\n desc: \"A quick status check, plus a hint at what to do next.\",\n },\n {\n name: \"!enlist <name>\",\n desc:\n \"Have your name entered on the rolls and begin your legend. Try !enlist random if you'd rather the Clerk pick a name for you.\",\n },\n ],\n },\n {\n title: \"Character & Combat\",\n commands: [\n {\n name: \"!chars\",\n desc:\n \"Read your character sheet — level, HP, AC, gold, and gear. !ledger works too.\",\n },\n {\n name: \"!chars <username>\",\n desc:\n \"Peek at someone else's sheet instead, e.g. !chars thistle_the_bold (their Twitch username, not their character's name).\",\n },\n {\n name: \"!hunt\",\n desc: \"Fight a level-appropriate monster for XP and gold.\",\n },\n {\n name: \"!hunt <monster name>\",\n desc:\n \"Seek out a specific monster by name, e.g. !hunt wolf — useful for working a bounty on the Quest Board.\",\n },\n {\n name: \"!autohunt\",\n desc:\n \"Chain fights automatically until you level up or need to rest. !auto works too.\",\n },\n { name: \"!rest\", desc: \"Recover to full health.\" },\n ],\n },\n {\n title: \"The Merchant's Stall\",\n commands: [\n {\n name: \"!merchant\",\n desc: \"See what's currently for sale. !shop works too.\",\n },\n {\n name: \"!buy <#|item name>\",\n desc:\n \"Purchase an offer from the stall, e.g. !buy 1 or !buy rapier.\",\n },\n {\n name: \"!sell <item>\",\n desc:\n \"Sell an item from your pack back to the stall for half its purchase price.\",\n },\n {\n name: \"!coinpurse\",\n desc:\n \"Check your gold, and whether you can afford anything on offer. !purse works too.\",\n },\n {\n name: \"!inventory\",\n desc: \"See everything you're carrying. !inv works too.\",\n },\n {\n name: \"!item\",\n desc:\n \"Look up the full details on whatever you're currently wielding or wearing.\",\n },\n {\n name: \"!item <item name>\",\n desc:\n \"Look up any item by name, whether you own it or not, e.g. !item greataxe. !iteminfo works too.\",\n },\n {\n name: \"!use <item>\",\n desc: \"Drink a potion, or equip a weapon or armor.\",\n },\n { name: \"!drop <item>\", desc: \"Discard an item from your pack.\" },\n ],\n },\n {\n title: \"The Quest Board\",\n commands: [\n {\n name: \"!quests\",\n desc:\n \"See the current bounties and your progress toward each. !board or !questboard work too.\",\n },\n {\n name: \"(auto turn-in)\",\n desc:\n \"Complete a bounty by hunting its target monster enough times — the reward is paid out the moment it's met, no extra command needed.\",\n },\n ],\n },\n {\n title: \"Starting Over\",\n commands: [\n {\n name: \"!discharge confirm\",\n desc:\n \"Retire your current character for good, so you can enlist a new one. The Clerk asks you to confirm first if you just say !discharge.\",\n },\n ],\n },\n {\n title: \"For Moderators & the Broadcaster\",\n commands: [\n {\n name: \"!clerkchannels\",\n desc: \"List every channel the Clerk currently serves. Open to anyone.\",\n },\n {\n name: \"!clerkjoin <channel>\",\n desc:\n \"Have the Clerk set up a desk in another channel. That channel's broadcaster must have already granted permission via the one-click invite link.\",\n },\n {\n name: \"!clerkleave <channel>\",\n desc: \"Stop the Clerk from replying in a channel.\",\n },\n ],\n },\n];\n\nfunction commandsGuidePage(): Response {\n const sectionsHtml = COMMAND_SECTIONS.map((section) => `\n

${section.title}

${c.name}: ${c.desc}

\n `).join(\"\");\n\n const html = `\n\n\n\n\nThe Wandering Clerk's Ledger\n\n\n\n\n\n

The Wandering Clerk's Ledger

Being a Complete Charter of Commands for Hunt & Hoard

\n ${sectionsHtml}\n \n

\n\n`;\n\n return new Response(html, {\n status: 200,\n headers: { \"content-type\": \"text/html\" },\n });\n}\n\nfunction json(data: unknown, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json\" },\n });\n}\n\nfunction isAuthorized(req: Request): boolean {\n return !!API_SECRET &&\n req.headers.get(\"authorization\") === `Bearer ${API_SECRET}`;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/{2,}/g, \"/\");\n\n if (path === \"/commands\") {\n return commandsGuidePage();\n }\n\n // --- Moderator-locked admin panel ---\n if (path === \"/admin\") {\n const login = await verifySession(req);\n if (!login) return renderAdminSignIn(req);\n const extraChannels = await getChannels();\n const allChannels = [\n HOME_CHANNEL,\n ...extraChannels.filter((c) => c !== HOME_CHANNEL),\n ];\n // A channel's own broadcaster only gets a tab for their own channel;\n // only super admins (you, or ADMIN_USERNAMES) can browse every channel\n // the Clerk serves.\n const visibleChannels = isSuperAdmin(login)\n ? allChannels\n : allChannels.filter((c) => c === login);\n const requested = (url.searchParams.get(\"channel\") || \"\").toLowerCase();\n const currentChannel = visibleChannels.includes(requested)\n ? requested\n : (visibleChannels[0] || HOME_CHANNEL);\n const flags = await getFeatureFlags(currentChannel);\n return renderAdminDashboard(login, currentChannel, visibleChannels, flags);\n }\n\n if (path === \"/admin/callback\") {\n const error = url.searchParams.get(\"error\");\n if (error) {\n return adminPage(`

Sign-in cancelled

${error}

`, 400);\n }\n\n const returnedState = url.searchParams.get(\"state\");\n const expectedState = getCookie(req, \"hh_admin_state\");\n const clearStateCookie =\n `hh_admin_state=; HttpOnly; Secure; SameSite=Strict; Path=/admin; Max-Age=0`;\n if (\n !returnedState || !expectedState ||\n !timingSafeEqual(returnedState, expectedState)\n ) {\n return adminPage(\n `

Sign-in failed

Couldn't verify this sign-in request. Go back to /admin and try again.

`,\n 400,\n { \"set-cookie\": clearStateCookie },\n );\n }\n\n const code = url.searchParams.get(\"code\");\n if (!code) {\n return adminPage(\n `

Missing authorization code

Go back to /admin and try again.

`,\n 400,\n { \"set-cookie\": clearStateCookie },\n );\n }\n\n const token = await exchangeCodeForToken(code, adminRedirectUriFor(req));\n if (!token) {\n return adminPage(\n `

Something went wrong

Couldn't complete sign-in with Twitch. Try again in a moment.

`,\n 500,\n { \"set-cookie\": clearStateCookie },\n );\n }\n\n const user = await getAuthorizingUser(token.access_token);\n if (!user) {\n return adminPage(\n `

Something went wrong

Couldn't identify your Twitch account.

`,\n 500,\n { \"set-cookie\": clearStateCookie },\n );\n }\n\n if (!(await isAuthorizedAdmin(user.login))) {\n return adminPage(\n `

Not authorized

Signed in as ${user.display_name}, but this account isn't set up as a moderator or the broadcaster for this bot. If that's wrong, ask the bot owner to add you.

`,\n 403,\n { \"set-cookie\": clearStateCookie },\n );\n }\n\n const sessionCookie = await makeSessionCookie(user.login);\n const headers = new Headers({ location: \"/admin\" });\n headers.append(\"set-cookie\", sessionCookie);\n headers.append(\"set-cookie\", clearStateCookie);\n return new Response(null, { status: 302, headers });\n }\n\n if (path === \"/admin/logout\") {\n const headers = new Headers({ location: \"/admin\" });\n headers.set(\"set-cookie\", clearSessionCookie());\n return new Response(null, { status: 302, headers });\n }\n\n if (path === \"/admin/toggle\") {\n if (req.method !== \"POST\") {\n return adminPage(`

Method not allowed

`, 405);\n }\n const login = await verifySession(req);\n if (!login) {\n return adminPage(\n `

Session expired

Please sign in again.

`,\n 401,\n );\n }\n\n const form = await req.formData();\n const channel = String(form.get(\"channel\") || \"\").toLowerCase();\n const key = String(form.get(\"key\") || \"\");\n const extraChannels = await getChannels();\n const allChannels = [\n HOME_CHANNEL,\n ...extraChannels.filter((c) => c !== HOME_CHANNEL),\n ];\n if (!allChannels.includes(channel)) {\n return adminPage(`

Unknown channel

`, 400);\n }\n if (!isSuperAdmin(login) && channel !== login) {\n return adminPage(`

Not authorized for that channel

`, 403);\n }\n if (!FEATURE_KEYS.includes(key)) {\n return adminPage(`

Unknown setting

`, 400);\n }\n const enabled = String(form.get(\"enabled\")) === \"1\";\n await setFeatureFlag(channel, key, enabled);\n return new Response(null, {\n status: 303,\n headers: { location: `/admin?channel=${encodeURIComponent(channel)}` },\n });\n }\n\n // --- Step 1: broadcaster lands here and clicks the single \"Authorize\" button ---\n if (path === \"/onboard\") {\n const authorizeUrl = new URL(\"https://id.twitch.tv/oauth2/authorize\");\n authorizeUrl.searchParams.set(\"client_id\", CLIENT_ID);\n authorizeUrl.searchParams.set(\"redirect_uri\", redirectUriFor(req));\n authorizeUrl.searchParams.set(\"response_type\", \"code\");\n authorizeUrl.searchParams.set(\"scope\", \"channel:bot\");\n return page(\n `

Bring The Wandering Clerk to your channel

` +\n `

Click below and log in as the broadcaster of the channel you want the Clerk to serve. ` +\n `This only grants permission for the bot to read and post in your chat — nothing else.

` +\n `

Authorize The Wandering Clerk

`,\n );\n }\n\n // --- Step 2: Twitch redirects back here with a code once they authorize ---\n if (path === \"/oauth/callback\") {\n const error = url.searchParams.get(\"error\");\n if (error) {\n return page(`

Authorization cancelled

${error}

`, 400);\n }\n\n const code = url.searchParams.get(\"code\");\n if (!code) {\n return page(\n `

Missing authorization code

Try the onboarding link again.

`,\n 400,\n );\n }\n\n const token = await exchangeCodeForToken(code, redirectUriFor(req));\n if (!token) {\n return page(\n `

Something went wrong

Couldn't complete authorization with Twitch. Try again in a moment.

`,\n 500,\n );\n }\n\n const user = await getAuthorizingUser(token.access_token);\n if (!user) {\n return page(\n `

Something went wrong

Couldn't identify your Twitch account.

`,\n 500,\n );\n }\n\n await addChannel(user.login, user.login);\n return page(\n `

You're all set, ${user.display_name}!

` +\n `

The Wandering Clerk checks for new channels every few minutes while it's running. ` +\n `Watch your chat for a message, or try typing !help.

`,\n );\n }\n\n // --- Storage API for the GitHub Actions-hosted bot process ---\n if (path.startsWith(\"/api/\")) {\n if (!isAuthorized(req)) return json({ error: \"unauthorized\" }, 401);\n\n if (path === \"/api/merchant\") {\n if (req.method === \"GET\") return json(await getMerchantOffers());\n if (req.method === \"PUT\") {\n await saveMerchantOffers(await req.json());\n return json({ ok: true });\n }\n }\n\n if (path === \"/api/quests\") {\n if (req.method === \"GET\") return json(await getQuestBoard());\n if (req.method === \"PUT\") {\n await saveQuestBoard(await req.json());\n return json({ ok: true });\n }\n }\n\n if (path === \"/api/channels\") {\n if (req.method === \"GET\") return json(await getChannels());\n if (req.method === \"POST\") {\n const body = await req.json();\n await addChannel(body.channel, body.addedBy);\n return json({ ok: true });\n }\n }\n\n const channelMatch = path.match(/^\\/api\\/channels\\/([^/]+)$/);\n if (channelMatch && req.method === \"DELETE\") {\n await removeChannel(decodeURIComponent(channelMatch[1]));\n return json({ ok: true });\n }\n\n const charMatch = path.match(/^\\/api\\/characters\\/([^/]+)$/);\n if (charMatch) {\n const username = decodeURIComponent(charMatch[1]);\n if (req.method === \"GET\") {\n const c = await getCharacter(username);\n return c ? json(c) : json({ error: \"not found\" }, 404);\n }\n if (req.method === \"PUT\") {\n await saveCharacter(await req.json());\n return json({ ok: true });\n }\n if (req.method === \"DELETE\") {\n await deleteCharacter(username);\n return json({ ok: true });\n }\n }\n\n const metaMatch = path.match(/^\\/api\\/meta\\/([^/]+)$/);\n if (metaMatch) {\n const key = decodeURIComponent(metaMatch[1]);\n if (req.method === \"GET\") {\n const value = await getMeta(key);\n return value === null\n ? json({ error: \"not found\" }, 404)\n : json({ value });\n }\n if (req.method === \"PUT\") {\n const body = await req.json();\n await setMeta(key, String(body.value));\n return json({ ok: true });\n }\n }\n\n return json({ error: \"not found\" }, 404);\n }\n\n return new Response(\n \"GuildBreak: Hunt & Hoard storage + onboarding service is running.\",\n {\n status: 200,\n headers: { \"content-type\": \"text/plain\" },\n },\n );\n}","deleted",false,"label","huntandhoardbot",[14],"18a739db-79f6-405b-989c-5ec0b798f374",["D",1788715747973],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","cc37ba10-6e6d-4af6-a801-9955c92d23c4","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04ba1-c79f-7319-b4f2-7c4f3772837b","tursoName","18a739db79f6405b989c5ec0b798f374","tursoHostname","18a739db79f6405b989c5ec0b798f374-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789500689328],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_56":57,"_102":103,"_104":42},"branch",{"_35":30,"_11":89,"_22":28,"_90":46,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Shea Stolp","avatar","https://lh3.googleusercontent.com/a/ACg8ocIWmQgR3gyoMMicg2zCAoN1c7i36qX5mf9gRIdIXm8F2mo-ig=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":63,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]